On August 31, 2022, the California legislature adjourned without extending certain exemptions set to expire on January 1, 2023, the effective date of the California Privacy Rights Act (CPRA). The limited expiring exemptions include those for employee and B2B data as associated with the CCPA. Such information may include personal information collected by a business about a person who was either a job applicant or past/current employee or in an otherwise related position, including owners, directors, officers, contractors and beneficiaries/dependents. The exemption is limited to when the business used the information provided "solely" for employment-related actions. As a result, employee and B2B data will be handled the same as consumer data.

The expiration of these exemptions means that covered businesses will be required to extend their CCPA compliance programs to also include personal information for employees and B2B contacts. This includes the requirement to supply California employees, contractors, applicants and business contacts with a complete set of disclosures and rights available to California consumers per the CPRA, such as: access, correction, portability and deletion of personal information.

It is important to note that while some of these exemptions are expiring, the CPRA still provides for the same federal Fair Credit Reporting Act (FCRA) exemption set forth under the CCPA, excluding personal information used by a consumer reporting agency to generate a consumer report under the FCRA. Sec. 1798.145(d)(1) of the CPRA states: "[t]his title shall not apply to activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's [...] personal characteristics [...] by a consumer reporting agency, as defined in subdivision (f) of Section 1681 a of Title 15 of the United States Code, [...] who provides information for use in a consumer report as defined by subdivision (d) of Section 1681a of Title 15 of the United States Code."

Certiphi Screening's legal counsel has reviewed the expiring exemption and has determined that even after becoming effective January 1, 2023, the CPRA will still provide for an FCRA exemption for use of information contained in consumer reports issued by Certiphi. Additionally, while information provided by Certiphi remains exempt, given the stringent requirements of the FCRA, Certiphi continues to comply with requirements for Service Providers under applicable California law.

Clients are well advised to consult with legal counsel to determine whether their use of employee and/or B2B data is subject to requirements under California law.

Updated: July 14, 2023

All Rights Reserved © 2023 Certiphi Screening, Inc.
This document and/or presentation is provided as a service to our customers. Its contents are designed solely for informational purposes, and should not be inferred or understood as legal advice or binding case law, nor shared with any third parties. Persons in need of legal assistance should seek the advice of competent legal counsel. Although care has been taken in preparation of these materials, we cannot guarantee the accuracy, currency or completeness of the information contained within it. Anyone using this information does so at his or her own risk.